# `POST /auth/login`

Public. No cookie required.

Login with Google ID token

Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`),
stores Google `sub` and profile image bytes, and sets an HTTP-only `token` cookie.
`user.picture` is the profile image as base64 (same as GET /auth/me).


## Body (JSON)

| Field | Required | Type | Description |
|-------|----------|------|-------------|
| `idToken` | yes | string | Google ID token from Google Identity Services |

```json
{
  "idToken": "<google-id-token>"
}
```

## Response `200`

Login successful; `token` cookie set

```json
{
  "message": "Login successful",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "selectedCompanyId": 1,
    "picture": "…"
  }
}
```

## Errors

| Status | Description |
|--------|-------------|
| 400 | Missing token or Google client not configured — `{"error":"…"}` |
| 401 | Invalid Google token or account — `{"error":"…"}` |
| 403 | Email not on allowlist — `{"error":"…"}` |
| 500 | Server error — `{"error":"…"}` |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._